warzonerat | 3ee783c204048897f91ce19e6ec58f85a6f2fd1f10bb1f06c3fcc1b6ae6f9b5b | Triage

Sharing

General

Target

3ee783c204048897f91ce19e6ec58f85a6f2fd1f10bb1f06c3fcc1b6ae6f9b5b
Size

2.9MB
Sample

241030-19xgzascrf
MD5

5f872bf66a9e456c70f7ee4fa6b53e4c
SHA1

b1671863784faf70581dbfe7567341dc5bf8f304
SHA256

3ee783c204048897f91ce19e6ec58f85a6f2fd1f10bb1f06c3fcc1b6ae6f9b5b
SHA512

3306d0938d1226d893b0e6db11b3a16ce183e71604c559b0c2dd42b60d062fac66cea810b32abcc8fd5b0ac2b85f832433baa732fa728b928da862aa5f16edc9
SSDEEP

24576:7v97AXmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHm:7v97AXmw4gxeOw46fUbNecCCFbNecF

Score

10^/10

warzonerat discovery evasion infostealer persistence rat

Malware Config

Targets

- Target
  
  3ee783c204048897f91ce19e6ec58f85a6f2fd1f10bb1f06c3fcc1b6ae6f9b5b
- Size
  
  2.9MB
- MD5
  
  5f872bf66a9e456c70f7ee4fa6b53e4c
- SHA1
  
  b1671863784faf70581dbfe7567341dc5bf8f304
- SHA256
  
  3ee783c204048897f91ce19e6ec58f85a6f2fd1f10bb1f06c3fcc1b6ae6f9b5b
- SHA512
  
  3306d0938d1226d893b0e6db11b3a16ce183e71604c559b0c2dd42b60d062fac66cea810b32abcc8fd5b0ac2b85f832433baa732fa728b928da862aa5f16edc9
- SSDEEP
  
  24576:7v97AXmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHm:7v97AXmw4gxeOw46fUbNecCCFbNecF
Score

10^/10

warzonerat discovery evasion infostealer persistence rat
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Warzonerat family
  warzonerat
- Warzone RAT payload
  rat
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

warzoneratdiscoveryevasioninfostealerpersistencerat

behavioral2

warzoneratdiscoveryevasioninfostealerpersistencerat